IN BRIEF:
• Cybersecurity Managed Services are shifting from fragmented, tool-focused activities toward integrated, scalable and outcome-focused cyber operations.
• Artificial intelligence (AI) is accelerating threat detection, investigation and response while increasing the need for human oversight.
• Organizations should assess whether their cybersecurity operating models provide continuous visibility, specialized expertise and rapid response.
Every October, governments, businesses, academic institutions and cybersecurity professionals observe Cybersecurity Awareness Month through initiatives promoting responsible digital behavior. SGV stands with the broader cyber community in advancing this shared objective.
One key topic emerging from these discussions is Cybersecurity Managed Services and their increasingly important role in supporting continuous cyber defense.
Modern cybersecurity requires expertise across threat intelligence, security monitoring, identity security, vulnerability management, investigation and response. However, maintaining these capabilities internally, particularly on a 24×7 basis, may not be practical for every organization.
WHAT ARE CYBERSECURITY MANAGED SERVICES?
Cybersecurity Managed Services combine specialized professionals, established processes and enabling technologies through a continuing service arrangement. Depending on organizational requirements, they may support:
• Identity and access management
• Threat detection and response
• Vulnerability and exposure management
• Security investigation and threat hunting
• Incident coordination and reporting
Cybersecurity Managed Services can also be delivered through fully managed, co-sourced or hybrid arrangements. In a co-sourced model, an external provider supplements selected capabilities while the organization retains governance, business knowledge and decision authority.
Cybersecurity Managed Services represent an operating-model decision about how organizations sustain critical capabilities, access specialized expertise and respond as threats evolve.
CYBER THREATS ARE OPERATING AT MACHINE SPEED
Traditional security models often rely on separate technologies, periodic assessments and manual processes. Although these remain important, they may not provide the connected visibility and speed required when threats move rapidly across identities, endpoints, cloud platforms and third parties.
Based on the 2026 EY Global Cybersecurity Leadership Insights Study, 36% of organizational assets have inadequate visibility and cybersecurity controls. At the same time, as much as 59% of organizations lack comprehensive asset telemetry, reducing visibility and delaying detection. Lastly, only 48% of cybersecurity leaders are confident in their ability to detect a supply-chain incident quickly.
These findings reinforce the shift from fragmented, tool-focused activities toward integrated, scalable and outcome-focused Cybersecurity Managed Services. Performance should be measured not only through technologies operated or alerts processed, but also through detection speed, connected analysis and the ability to scale response.
THE RISE OF AI-ENABLED CYBERSECURITY MANAGED SERVICES
Artificial intelligence (AI) is changing how organizations detect, investigate and respond to threats. The 2026 EY Cybersecurity Roadmap Study indicates that AI is reshaping both the threat landscape and cybersecurity investment priorities.
As many as 96% of senior security leaders consider AI-enabled attacks a significant threat, but only 48% estimate that at least one-quarter of their organizations’ recent cybersecurity incidents were enabled by AI. The study also projected an increase (from 9% to 48%) in organizations allocating at least one-quarter of their cybersecurity budgets to AI within two years.
Within Cybersecurity Managed Services, AI can enrich alerts, prioritize incidents, support investigations, and recommend response actions. In addition, agentic AI can extend these capabilities by coordinating multistep activities across identity, cloud, endpoint and other security domains.
AI enhances rather than replaces cybersecurity professionals. Effective implementation requires trusted data, access controls, human oversight, and defined approval and escalation thresholds for actions with material consequences.
PHILIPPINE CYBERSECURITY MANAGED SERVICES
The Philippine policy environment is moving toward stronger cybersecurity governance and continuous protection of essential services. House Bill No. 9605, or the proposed National Cybersecurity and Critical Information Infrastructure Protection Act of 2026, was approved by the House of Representatives on third and final reading on Aug. 12. It proposes a National Cybersecurity Agency and stronger expectations for government institutions and operators of critical information infrastructure.
The proposed requirements emphasize governance, cybersecurity leadership and accountability; risk assessments, audits, and asset and vulnerability management; continuous monitoring and protection of critical systems; and incident reporting, response and coordination.
Cybersecurity Managed Services can help enable implementation through continuous threat detection, vulnerability management, incident investigation, reporting, specialized expertise and round-the-clock operational capacity. This is particularly relevant where building every required role and technology platform internally is not practical.
The proposed oversight of cybersecurity service providers also reinforces the need for organizations to select, govern and evaluate Cybersecurity Managed Services providers carefully. Cybersecurity Managed Services can enable implementation, while cybersecurity governance and material decisions remain with the organization.
RETHINKING THE CYBERSECURITY OPERATING MODEL
Organizations must assess their internal strengths, capability gaps and outcomes that may require Managed Services. They should determine which responsibilities must remain internal, where AI can improve speed and scale, and what governance boundaries should apply to AI-enabled actions.
Cybersecurity Managed Services should be evaluated through outcomes, including detection speed, incident containment, clear risk communication and the ability to scale response when needed.
A sustainable operating model combines continuous operations and specialized capabilities with the deliberate use of AI, human judgment and accountable leadership, allowing organizations to maintain continuous cyber defense amidst a rapidly evolving technological landscape.
This article is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinions expressed above are those of the authors and do not necessarily represent the views of SGV & Co.
Anna L. De Vega and Jay S. Yabes are a technology consulting senior director and manager of SGV & Co., respectively.
